1. INTRODUCTION
The basic tenet of the changed product rule is that compliance of significant changes with the latest requirements will enhance the level of safety of these aviation products. However, in certain cases the cost of complying fully with a later requirement may not be commensurate with a small safety benefit achieved. It is also understood that the existing fleet and newly produced aeroplanes, engines and propellers are safe, and that any unsafe condition is immediately addressed through the airworthiness directive process. These concepts form the basis of finding it to be impractical to comply with a later requirement, allowing compliance with an earlier requirement is acceptable. This appendix gives one method of determining if compliance with a later requirement is impractical; however this does not preclude the use of other methods that have as a goal improving the safety of aeronautical products.
This GM recognises that other procedures have been used for some products and have been historically been accepted on a case-by-case basis. These procedures have not been fully harmonised and may not be acceptable for all products. It is envisaged that other methods will be developed and become part of this GM. Regardless of which method is used, the fundamental premise of these methods must be for the applicant to demonstrate a resource effective type-certification basis showing a positive safety benefit for the overall product. In this regard, any method used must also encourage incorporating the safety enhancements that will have the most dramatic impact on the accident rate and recognize the effective utilization of limited resources. This important point is illustrated graphically in the accompanying figure. This figure notionally shows the interrelation between the total resources required for incorporating each potential safety enhancement with the corresponding net increase in safety benefit. Typically one will find that there are proposals that will produce a positive safety benefit that can be introduced very resource effectively.
Conversely, there are those that may produce small safety benefit but may require a large amount of resources to implement. Clearly, there will be a point where a large percentage of the potential safety benefit can be achieved with a reasonable expenditure of resources. The focus of the methods used should be to determine the most appropriate set of safety-significant regulatory standards relative to the respective cost to reach this point.
This Appendix to GM 21A.101 provides procedural guidance that maybe used as a starting point to determine the practicality of applying a requirement at a particular amendment level to a changed product. This guidance can be used for evaluating the safety benefit and resource impact of implementing the latest airworthiness requirements in the type-certification basis of a changed product.
The procedure is generic in nature and describes the steps and necessary inputs that any applicant may use on any project to develop a position.
Safety Benefit of the regulatory requirement
Resources to implement the regulatory requirement
Potential Safety Enhancements
a. The procedure is intended to be used, along with good engineering judgement, to evaluate the relative merits of a changed product complying with the latest requirements.
b. This procedure provides a means, but not the only means, for an applicant to present its position in regards to impracticality.
c. The type-certification basis for a change to a product will not be at an amendment level earlier than the existing type-certification basis. Therefore, when determining the impracticality of applying a requirement at the latest amendment level only the increase in safety benefits and costs beyond compliance with the existing type-certification basis should be considered.
d. The following are steps to determine the impracticality of applying a requirement at a particular amendment level. The first step will be to identify the regulatory change being evaluated.
Step 1: Identify the Regulatory Change Being Evaluated In this step it will be necessary to document:
The specific requirement (e.g., CS 25.365),
The amendment level of the existing type-certification basis for the requirement, and The latest amendment level of the requirement.
Step 2: Identify the Specific Hazard that the Requirement Addresses
a. Each requirement and requirement amendment is intended to address a hazard or hazards. In this step the specific hazard(s) are identified. This identification will allow for a comparison of the effectiveness of amendment levels of the requirement at addressing the hazard.
b. In many cases the hazard and the cause of the hazard will be obvious. When the hazard and its related cause are not immediately obvious it may be necessary to review the explanatory note and comment/response document to the NPA and discuss the hazard with the Agency.
Step 3: Review the Consequences of the Hazard(s)
a. Once the hazard has been identified it is possible to identify the types of consequences that may occur because of the presence of the hazard. More than one consequence can be attributed for the same hazard. Typical examples of consequences would include, but not be limited to,:
(1) Incidents where only injuries occurred,
(2) Accidents where less than 10% of the passengers succumbed to their injuries, (3) Accidents where 10% or more passengers succumbed to their injuries, and (4) Accidents where a total hull loss occurred.
b. The explanatory note and comment/response document to the NPA may provide useful information regarding the consequences of the hazard the requirement is intended to address.
Step 4: Identify the Historical and Predicted Frequency of each Consequence
a. Another input in determining impracticality is the historical record of the consequences of the hazard that led to a requirement or an amendment to a requirement. From this data a frequency of occurrence for the hazard can be determined. It is important to recognise that the frequency of occurrence may be higher or lower in the future. Therefore, it also is necessary to predict the frequency of future occurrences.
b. More than one consequence can be attributed for the same hazard. Therefore, when applicable, the combination of consequences and frequencies of those consequences should be considered together.
c. The explanatory note and comment/response document to the NPA may provide useful information regarding the frequency of occurrence.
Step 5: Determine How Effective Full Compliance with the Latest Amendment of the Requirement would be at Addressing the Hazard
a. When each amendment is promulgated it is expected that compliance with the requirement would be completely effective at addressing the associated hazard. It is expected that the hazard would be eliminated, avoided, or dealt with. However, in a limited number of situations this may not be the case.
It is also possible that earlier amendment levels may have addressed the hazard but were not completely effective. Therefore, in comparing the benefits of compliance with the existing type-certification basis to the latest amendment level it is useful to estimate the effectiveness of both amendment levels in dealing with the hazard.
b. It is recognised that the determination of levels of effectiveness is normally of a subjective nature.
Therefore, prudence should be exercised when making these determinations. In all cases it is necessary to document the assumptions and data that support the determination.
c. The following five levels of effectiveness are provided as a guideline.
(1) Fully effective in all cases
Compliance with the requirement eliminates the hazard or provides a means to completely avoid the hazard.
(2) Considerable potential for eliminating or avoiding the hazard
Compliance with the requirement eliminates the hazard or provides a means to completely avoid the hazard for all probable or likely cases. However it does not cover all situations or scenarios.
(3) Adequately deals with the hazard
Compliance with the requirement eliminates the hazard or provides a means to completely avoid the hazard in many cases. However, the hazard is not eliminated or avoided in all probable or likely cases. Usually this action only addresses a significant part of a larger or broader hazard.
(4) Hazard only partly addressed
In some cases compliance with the requirement partly eliminates the hazard or does not completely avoid the hazard. The hazard is not eliminated or avoided in all probable or likely cases. Usually this action only addresses part of a hazard.
(5) Hazard only partly addressed but action has negative side effect
Compliance with the requirement does not eliminate or avoid the hazard or may have negative safety side effects. The action is of questionable benefit.
Step 6: Determine Resource Costs and Cost Avoidance
a. There is always a cost associated with complying with a requirement. This cost may range from minimal administrative efforts to the resource expenditures necessary to support full scale testing or the redesign of a large portion of an aircraft. However, there are also potential cost savings from compliance with a requirement. For example, compliance with a requirement may avoid aircraft damage or accidents and the associated costs to the manufacturer for investigating accidents.
Compliance with the latest amendment of a requirement may also facilitate certification of a product by the competent authority of a third country.
b. When determining the impracticality of applying a requirement at the latest amendment level only the increase in costs, and safety benefits from complying with the existing type-certification basis should be considered.
c. When evaluating the cost, it may be beneficial for the applicant to compare the increase in cost to comply with the latest requirements to the cost to incorporate the same design feature in a new aeroplane. In many cases, an estimate for the cost of incorporation in a new aeroplane is provided in the regulatory evaluation by the Agency that was presented when the corresponding requirement was first promulgated. Incremental costs of retrofit/incorporation on existing designs may be higher than that for production. Examples of costs may include, but are not limited to,:
(1) Costs: The accuracies of fleet size projections, utilisation, etc. may be different than that experienced in actuality for derivative product designs and must be validated.
(a) Labour: Work carried out in the design, fabrication, inspection, operation or maintenance of a product for the purpose of incorporating or demonstrating compliance with a proposed action. Non-recurring labour requirements, including training should be considered.
(b) Capital: Construction of new, modified or temporary facilities for design, production, tooling, training or maintenance.
(c) Material: Cost associated with product materials, product components, inventory, kits and spares.
(d) Operating Costs: Costs associated with fuel, oil, fees and expendables.
(e) Revenue/Utility Loss: Costs resulting from earning/usage capability reductions from departure delays, product downtime, capability reductions of performance loss due to seats, cargo, range or airport restrictions.
(2) Cost Avoidance
(a) Avoiding cost of accidents including investigation of accidents, lawsuits, public relations activities, insurance, and lost revenue.
(b) Foreign Certification: Achieve a singular effort that would demonstrate compliance with the requirements of most competent authorities , thus minimising certification costs.
Step 7: Document Conclusion Regarding Practicality
a. Once the information from previous steps has been documented and reviewed, the applicant’s position and rationale regarding practicality can be documented. Examples of possible positions would include, but are not limited to:
(1) Compliance with the latest requirement is necessary. The applicant would pursue the change at the latest amendment level.
(2) Compliance with an amendment level between the existing type-certification basis and the latest amendment would adequately address the hazard at an acceptable cost, while meeting the latest amendment level would be impractical. The applicant would then propose the intermediate amendment level of the requirement.
(3) The increased level of safety is not commensurate with the increased costs associated with meeting the latest amendment instead of the existing type-certification basis. Therefore, the applicant would propose the existing type-certification basis.
(4) The results of this analysis were inconclusive. Further discussions with the Agency are warranted.
NOTE: This process may result in a required type-certification basis that renders the proposed modification economically not viable.
2 EXAMPLES
The following examples are for large aeroplanes and are illustrative of the typical process followed by an applicant. The process will be the same for all product types.
2.1 Example 1: § 25.963 Fuel Tank Access Covers
(NOTE: This example is taken from a FAA certification, so references are made to FAR sections and amendments.)
a. This change is part of a significant transport aeroplane model change that increases passenger payload and gross weight by extending the fuselage 20 feet. The model change will feature increased thrust engines, strengthened wing and fuselage, and a completely redesigned landing gear.
To accommodate the higher design weights, increased braking requirements and to reduce runway loading, the applicant will change the landing gear from a two-wheel to four-wheel configuration. The new model aeroplane will be required to comply with the latest applicable requirements based on the date of application.
b. The wing will be strengthened locally at the side of the body and at the attachment of engines and landing gear, but the applicant would not like to alter wing access panels and the fuel tank access covers. Although the applicant recognises that the scatter pattern and impact loading on the wing from debris being thrown from the landing gear will change, it proposes that it would be impractical to redesign the fuel tank access covers.
c. The applicant proposes to change the landing gear from a two-wheel configuration to a four-wheel configuration. This changes the debris scatter on the wing from the landing gear.
Step 1: Identify the Regulatory Change Being Evaluated
a. The existing type-certification basis of the aeroplane that is being changed is part 25 prior to amendment 69.
b. Amendment 25-69 added the requirement that fuel tank access covers on transport category aeroplanes be designed to minimise penetration by likely foreign objects, and be fire resistant.
Step 2: Identify the Specific Hazard that the Requirement Addresses
Fuel tank access covers have failed in service due to impact with high-energy objects such as failed tire tread material and engine debris following engine failures. In one accident, debris from the runway impacted a fuel tank access cover, causing its failure and subsequent fire, which resulted in fatalities and loss of the aeroplane. Amendment 25-69 will ensure that all access covers on all fuel tanks are designed or located to minimise penetration by likely foreign objects, and are fire resistant.
Step 3: Review the History of the Consequences of the Hazard(s) Occurrences with injuries, and with more than 10% deaths
Step 4: Identify the Historical and Predicted Frequency of Each Consequence a. In 200 million departures of large jets,
(1) 1 occurrence with more than 10% deaths, and (2) 1 occurrence with injuries.
b. There is no reason to believe that the future rate of accidents will be significantly different than the historical record.
Step 5: Determine How Effective Full Compliance with the Latest Amendment of the Requirement would be at addressing the Hazard
Considerable potential for eliminating or avoiding the hazard
Compliance with amendment 25-69 eliminates the hazard or provides a means to completely avoid the hazard for all probable or likely cases. However, it does not cover all situations or scenarios
Step 6: Determine Resource Costs and Cost Avoidance a. Costs:
(1) For a newly developed aeroplane there would be minor increases in labour resulting from design and fabrication.
(2) There would be a negligible increase in costs related to materials, operating costs, and revenue utility loss.
b. Cost avoidance:
(1) There were 2 accidents in 200 million departures. The applicant believes that it will manufacture more than 2000 of these aeroplanes or derivatives of these aeroplanes. These aeroplanes would average 5 flights a day. Therefore, statistically there will be accidents in the future if the hazard is not alleviated. Compliance will provide cost benefits related to avoiding lawsuits, accident investigations and public relation costs.
(2) There are cost savings associated with meeting a single type-certification basis for FAA and foreign requirements.
Step 7: Document Conclusion Regarding Practicality
It is concluded that compliance with the latest requirement increases the level of safety at a minimal cost to the applicant. Based on the arguments and information presented by the applicant through the issue paper process, the Agency determined that meeting the latest amendment would not be impractical.
2.2 Example 2: § 25.365 Pressurised Compartment Loads
(NOTE: This example is taken from a FAA certification, so references are made to FAR sections and amendments.)
a. For the product change described in Example 1, the lengthened fuselage affects the size of the main deck passenger compartment and the lower centre cargo compartment. The applicant plans to comply fully with the latest pressurised compartment loads except for one interior partition for which the applicant believes compliance would be impractical.
b. The applicant proposes to increase the length of the fuselage by installing fuselage plugs. This change affected the size of the main deck passenger compartment and the lower centre cargo compartment.
Step 1: Identify the Regulatory Change Being Evaluated
a. The existing type-certification basis of the aeroplane that is being changed includes § 25.365 at amendment 25-54. The initial release of § 25.365 required that interior structure of passenger compartments be designed to withstand the effects of a sudden release of pressure through an opening resulting from the failure or penetration of an external door, window, or windshield panel, or from structural fatigue or penetration of the fuselage, unless shown to be extremely remote.
b. Amendment 25-54 revised § 25.365 to require that the interior structure be designed for an opening resulting from penetration by a portion of an engine, an opening in any compartment of a size defined by § 25.365(e)(2), or the maximum opening caused by a failure not shown to be extremely improbable.
c. Amendment 25-71 extended the requirement to all pressurised compartments, not just passenger compartments, and to the pressurisation of unpressurised areas. The later requirement had previously been identified as an unsafe feature under § 21A.21(b)(2).
Step 2: Identify the Specific Hazard that the Requirement Addresses
The hazard is a catastrophic structure and/or system failure produced by a sudden release of pressure through an opening in any compartment in flight. This opening could be caused by an uncontained engine failure, an opening of a prescribed size due to the inadvertent opening of an external door in flight, or by an opening caused by a failure not shown to be extremely improbable.
The opening could be produced by an event that has yet to be identified.
Step 3: Review the History of the Consequences of the Hazard(s)
Occurrences with injuries, less than 10% deaths, and more than 10% deaths
Step 4: Identify the Historical and Predicted Frequency of Each Consequence a. In 200 million departures of large jets,
(1) 2 occurrences with more than 10% deaths, (2) 1 occurrence with less than 10% deaths, and (3) 1 occurrence with injuries.
b. There is no reason to believe that the future rate of accidents will be significantly different than the historical record.
Step 5: Determine How Effective Full Compliance with the Latest Amendment of the Requirement would be at addressing the Hazard
a. Fully effective in all cases
Compliance with amendment 25-71 eliminates the hazard or provides a means to completely avoid the hazard.
b. Considerable potential for eliminating or avoiding the hazard
Compliance with amendment 25-54 eliminates the hazard or provides a means to completely
Compliance with amendment 25-54 eliminates the hazard or provides a means to completely